MAC Address (OUI)
Definition
48-bit hardware address. First 24 bits are the Organisationally Unique Identifier assigned by IEEE to a vendor; the lower 24 are the vendor's own serial.
- Total length
- 48 bits
- OUI portion
- First 24 bits, IEEE-assigned
- Device portion
- Lower 24 bits, vendor-assigned
- Forensic use
- Identifying device manufacturer from traffic
Common questions
How is the OUI used in an investigation?+
Investigators can look up the OUI portion of a captured MAC address in IEEE's public registry to identify the manufacturer of the network interface, narrowing down what kind of device was present on a network before the device itself is seized.
Does the OUI reliably identify the exact device?+
No, it only identifies the vendor of the network interface chipset, not the specific model or owner, and modern MAC randomisation can present a locally-assigned address that does not map to any real vendor OUI at all.
Related terms
- CIDR (Classless Inter-Domain Routing)
- A compact notation for IP address ranges that appends a prefix length to the address, such as 192.168.1.0/24. The prefix length states...
- OSI Reference Model
- Seven-layer ISO/IEC 7498-1 model describing how network functions are partitioned: Physical, Data Link, Network, Transport, Session, Presentation, Application. A teaching model, not...
- RFC 1918 Private Space
- Three IPv4 ranges reserved for private use: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16. Not routable on the public internet; require NAT at the edge.
- SLAAC
- Stateless Address Autoconfiguration. IPv6 host generates its own address from the router-advertised /64 prefix plus a 64-bit interface identifier (EUI-64 or RFC...
- TCP/IP Stack
- Four-layer model that actually runs the internet: Link, Internet, Transport, Application. Defined by the IETF and mapped onto the OSI layers for...